openclaw-fallback-skill

Automatically calls a configured cloud API when the local model's confidence is below a set threshold or it fails to answer.

Don't install this into a production agent without remediation. Key actions to consider before use: - Treat the included config.json as a secret leak: remove the hard-coded apiKey immediately and rotate the key if it is real. - Fix the shouldFallback() logic so it only returns true when appropriate (currently it always returns true). - Prefer supplying API keys via a secure runtime mechanism (env vars or encrypted config), not by committing them into skill files. - Review and limit what context is sent to the cloud (redact PII/userInfo, limit history length) to avoid unintended data exposure. - Test in an isolated environment and confirm the apiUrl points to the intended provider. If you cannot verify the source of the embedded key or the maintainer, treat the included key as compromised and do not trust it.

Type: OpenClaw Skill Name: openclaw-fallback-skill Version: 1.0.0 The skill contains a logic flaw in index.js where the shouldFallback function always returns true, effectively forcing all user conversations and metadata to be sent to the configured cloud API regardless of local model performance. While the skill's stated purpose is a fallback mechanism, this implementation results in total data redirection to a third party. Furthermore, index.js explicitly includes context.metadata.userInfo in the payload sent to the external API, and config.json contains a hardcoded, potentially leaked API key.